diff --git a/server/src/index.ts b/server/src/index.ts
index 6721faa..e45751f 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -7,6 +7,7 @@ import erpRoutes from './routes/erp';
 import etlRoutes from './routes/etl';
 import seasonsRoutes from './routes/seasons';
 import usersRoutes from './routes/users';
+import { discoverTableIds, ensureTableFields } from './services/nocodbClient';
 
 const app = express();
 app.use(cors({ origin: true, credentials: true }));
@@ -32,6 +33,15 @@ app.listen(server.port, () => {
   if (nocodb.url && nocodb.token) {
     console.log('  NocoDB: configured');
     console.log('  POST /api/etl/sync?mode=full|incremental');
+    // Ensure Users table has permission fields
+    discoverTableIds().then(tables => {
+      if (tables['Users']) {
+        return ensureTableFields(tables['Users'], [
+          { title: 'AllowedMuseums', uidt: 'LongText' },
+          { title: 'AllowedChannels', uidt: 'LongText' },
+        ]);
+      }
+    }).catch(err => console.warn('  NocoDB migration warning:', err.message));
   } else {
     console.log('  NocoDB: WARNING — not configured');
   }
diff --git a/server/src/services/nocodbClient.ts b/server/src/services/nocodbClient.ts
index 52a1978..c97bb57 100644
--- a/server/src/services/nocodbClient.ts
+++ b/server/src/services/nocodbClient.ts
@@ -125,6 +125,22 @@ export async function fetchAllRecords<T>(tableId: string): Promise<T[]> {
   return all;
 }
 
+export async function ensureTableFields(tableId: string, fields: Array<{ title: string; uidt: string }>): Promise<void> {
+  const json = await fetchJson(
+    `${nocodb.url}/api/v2/tables/${tableId}/fields`
+  ) as { list: Array<{ title: string }> };
+  const existing = new Set(json.list.map(f => f.title));
+  for (const field of fields) {
+    if (!existing.has(field.title)) {
+      await fetchJson(`${nocodb.url}/api/v2/tables/${tableId}/fields`, {
+        method: 'POST',
+        body: JSON.stringify(field),
+      });
+      console.log(`  NocoDB: created field '${field.title}' on table ${tableId}`);
+    }
+  }
+}
+
 export async function createRecord<T extends Record<string, unknown>>(tableId: string, record: T): Promise<T> {
   return await fetchJson(`${nocodb.url}/api/v2/tables/${tableId}/records`, {
     method: 'POST',